CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2018-11067: Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability
Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

Affected products: Dell EMC Avamar, Dell EMC Integrated Data Protection Appliance
CWE: Open Redirection Vulnerability
ATT&CK exploitation technique(s): T1566.002
ATT&CK secondary impact: T1036
ATT&CK techniques (all): T1036, T1566.002
CVE-2022-22718: Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows 10 Version 1909, Microsoft Windows 10 Version 21H1, Microsoft Windows Server 2022, Microsoft Windows 10 Version 20H2, Microsoft Windows Server version 20H2, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2008  Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation)
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1078
CVE-2019-1594: Cisco NX-OS Software 802.1X Extensible Authentication Protocol over LAN Denial of Service Vulnerability
A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times, leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).

Affected products: Cisco Nexus 1000V Switch for VMware vSphere, Cisco Nexus 3000 Series Switches, Cisco Nexus 3500 Platform Switches, Cisco Nexus 2000, 5500, 5600, and 6000 Series Switches, Cisco Nexus 7000 and 7700 Series Switches, Cisco Nexus 9000 Series Fabric Switches in ACI Mode, Cisco Nexus 9000 Series Switches in Standalone NX-OS Mode
CWE: CWE-264
CVSS: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1499.004
ATT&CK techniques (all): T1190, T1499.004
CVE-2015-0984: 
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.

ATT&CK techniques (all): T1005, T1190, T1552
CVE-2024-4358: Registration Authentication Bypass Vulnerability
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected products: Progress Software Corporation Telerik Report Server, progress_software telerik_report_server
CWE: CWE-290 Authentication Bypass by Spoofing
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK techniques (all): T1190
CVE-2020-15096: Context isolation bypass via Promise in Electron
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.

Affected products: electron electron
CWE: CWE-501 Trust Boundary Violation
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2008-4996: 
init in initramfs-tools 0.92f allows local users to overwrite arbitrary files via a symlink attack on the /tmp/initramfs.debug temporary file.  NOTE: the vendor disputes this vulnerability, stating that "init is [used in] a single-user context; there's no possibility that this is exploitable.

CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
ATT&CK techniques (all): T1068, T1565.001
CVE-2018-8355: 
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8353, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.

Affected products: Microsoft ChakraCore, Microsoft Internet Explorer 11, Microsoft Microsoft Edge
CWE: Remote Code Execution
ATT&CK exploitation technique(s): T1189, T1204.002
ATT&CK primary impact: T1499.004, T1574
ATT&CK secondary impact: T1005, T1136, T1485, T1565
ATT&CK techniques (all): T1005, T1136, T1189, T1204.002, T1485, T1499.004, T1565, T1574
CVE-2020-6964: 
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.

Affected products: GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
CWE: CWE-306 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
ATT&CK primary impact: T1068, T1190
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1068, T1190
CVE-2020-9459: 
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.

ATT&CK techniques (all): T1059.007, T1190, T1491, T1539, T1565
CVE-2020-5379: 
Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in System Management Mode (SMM).

Affected products: Dell CPG BIOS
CWE: CWE-693: Protection Mechanism Failure
CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1542.001
ATT&CK techniques (all): T1542.001
CVE-2017-5613: 
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.

ATT&CK techniques (all): T1203
CVE-2025-21391: Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:O/RC:C
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1485, T1490
ATT&CK techniques (all): T1068, T1485, T1490
CVE-2020-13126: 
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.

CVSS: CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
ATT&CK techniques (all): T1190, T1203
CVE-2022-42475: 
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Affected products: Fortinet FortiProxy, Fortinet FortiOS
CWE: CWE-197 Execute unauthorized code or commands
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1574
ATT&CK secondary impact: T1071.001, T1622
ATT&CK techniques (all): T1071.001, T1190, T1574, T1622
CVE-2020-0981: 
A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploited the vulnerability could allow an application with a certain integrity level to execute code at a different integrity level, leading to a sandbox escape.The update addresses the vulnerability by correcting how Windows handles token relationships, aka 'Windows Token Security Feature Bypass Vulnerability'.

Affected products: Microsoft Windows 10 Version 1909 for 32-bit Systems, Microsoft Windows 10 Version 1909 for x64-based Systems, Microsoft Windows 10 Version 1909 for ARM64-based Systems, Microsoft Windows Server, version 1909 (Server Core installation), Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation)
CWE: Security Feature Bypass
ATT&CK primary impact: T1134
ATT&CK secondary impact: T1068, T1497
ATT&CK techniques (all): T1068, T1134, T1497
CVE-2018-10633: 
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.

Affected products: Universal Robots Universal Robots Robot Controller version CB 3.1, SW Version 3.4.5-100
CWE: CWE-798 USE OF HARD-CODED CREDENTIALS CWE-798
ATT&CK primary impact: T1078.001
ATT&CK techniques (all): T1078.001
CVE-2017-11292: 
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Affected products: Adobe Flash Player version 27.0.0.159 and earlier
CWE: arbitrary code execution, CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.002, T1566.001
ATT&CK primary impact: T1105
ATT&CK secondary impact: T1005
ATT&CK techniques (all): T1005, T1105, T1204.002, T1566.001
CVE-2017-10810: 
Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures.

ATT&CK techniques (all): T1499.004
CVE-2021-32030: 
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

CWE: CWE-287 Improper Authentication
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1040, T1098
ATT&CK techniques (all): T1040, T1068, T1098
CVE-2018-12520: 
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.

ATT&CK techniques (all): T1110
CVE-2025-32433: Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Affected products: erlang otp
CWE: CWE-306: Missing Authentication for Critical Function
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1021.004
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1021.004, T1059
CVE-2011-2005: 
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203
CVE-2025-4428: Remote Code Execution
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Affected products: Ivanti Endpoint Manager Mobile
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1543
ATT&CK techniques (all): T1059, T1190, T1543
CVE-2024-21893: 
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Affected products: Ivanti ICS, Ivanti IPS, ivanti connect_secure, ivanti policy_secure
CWE: CWE-918 Server-Side Request Forgery (SSRF)
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1078
ATT&CK secondary impact: T1505.003, T1555
ATT&CK techniques (all): T1078, T1190, T1505.003, T1555
CVE-2018-2628: 
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products: Oracle Corporation WebLogic Server
CWE: Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server., CWE-502 Deserialization of Untrusted Data
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2020-1141: 
An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0963, CVE-2020-1145, CVE-2020-1179.

Affected products: Microsoft Windows, Microsoft Windows Server, Microsoft Windows 10 Version 1909 for 32-bit Systems, Microsoft Windows 10 Version 1909 for x64-based Systems, Microsoft Windows 10 Version 1909 for ARM64-based Systems, Microsoft Windows Server, version 1909 (Server Core installation), Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation)
CWE: Information Disclosure
ATT&CK primary impact: T1005
ATT&CK secondary impact: T1211
ATT&CK techniques (all): T1005, T1211
CVE-2014-7187: 
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

ATT&CK techniques (all): T1189, T1203, T1204.002, T1499.004
CVE-2019-15998: Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability
A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device.

Affected products: Cisco Cisco IOS XR Software
CWE: CWE-284
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1133
ATT&CK techniques (all): T1078, T1133
CVE-2013-3336: 
Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.

ATT&CK techniques (all): T1055
CVE-2018-15776: iDRAC7, iDRAC8 - Improper Error Handling
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.

Affected products: Dell EMC iDRAC
CWE: Improper Error Handling Vulnerability.
CVSS: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2023-29300: Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Affected products: Adobe ColdFusion
CWE: CWE-502 Deserialization of Untrusted Data (CWE-502)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1105
ATT&CK techniques (all): T1105, T1190
CVE-2019-5786: 
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Affected products: Google Chrome
CWE: CWE-416 Use After Free
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
ATT&CK techniques (all): T1068, T1211
CVE-2020-5270: Open redirection when using back parameter of PrestaShop
In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5

Affected products: PrestaShop PrestaShop
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
ATT&CK exploitation technique(s): T1566.002
ATT&CK secondary impact: T1005, T1036, T1059.007, T1557
ATT&CK techniques (all): T1005, T1036, T1059.007, T1557, T1566.002